Management apparatus of managing devices using history of communication processes, management system of managing devices using history of communication processes, and management method of managing devices using history of communication processes

ABSTRACT

A management apparatus includes a memory and a processor coupled to the memory. The processor is configured to execute a grouping process that includes a collection process which collect information from each of a plurality of devices based on a history of communication processes executed with another device of the plurality of devices and store the information in the memory, execute a creation process which create a group by correctively combining one or more pairs of communication source and communication destination devices in which communication processes of a same type were executed at a same time interval based on the information collected in the collection process and output display information for displaying information of the devices included in the group created by the grouping process.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of priority of theprior Japanese Patent Application No. 2020-12223, filed on Jan. 29,2020, the entire contents of which are incorporated herein by reference.

FIELD

The embodiments discussed here are related to a management apparatus, amanagement system, and a management method.

BACKGROUND

The maintenance work of the computer system includes, for example,replacement, expansion, and disposal of a device, installation anduninstallation of a program, update, recovery of a device in which anabnormality has occurred, and the like. In recent years, large-scalecomputer systems including a large number of computers and communicationdevices, such as data centers, have been increasing, and the number ofmanagement target devices has been increasing accordingly. As the numberof management target devices increases, the maintenance work becomesmore complicated.

Japanese Laid-open Patent Publication Nos. 2011-55231 and 09-69083 areexamples of related art.

SUMMARY

According to an aspect of the embodiments, a management apparatusincludes: a memory; and a processor coupled to the memory and configuredto: execute a grouping process that includes a collection processconfigured to collect information from each of a plurality of devicesbased on a history of communication processes executed with anotherdevice of the plurality of devices and store the information in thememory; execute a creation process configured to create a group bycorrectively combining one or more pairs of communication source andcommunication destination devices in which communication processes of asame type were executed at a same time interval based on the informationcollected in the collection process; and output display information fordisplaying information of the devices included in the group created bythe grouping process.

The object and advantages of the invention will be realized and attainedby means of the elements and combinations particularly pointed out inthe claims.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and arenot restrictive of the invention.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram illustrating a configuration example and a processexample of a management apparatus according to a first embodiment;

FIG. 2 is a diagram illustrating a configuration example of aninformation processing system according to a second embodiment;

FIG. 3 is a diagram illustrating a hardware configuration example of anode management apparatus;

FIG. 4 is a diagram illustrating a comparative example regardingcreation of an asset information list;

FIG. 5 is a diagram illustrating a configuration example of processingfunctions included in a node and a node management apparatus;

FIG. 6 is a diagram for explaining an example of a data collectionprocess by a data collection unit;

FIG. 7 is an example of a flowchart illustrating a data collectionprocess procedure;

FIG. 8 is an example of a flowchart illustrating a data analysis processprocedure by a data analysis unit;

FIG. 9 is a diagram illustrating an example of classified data files andan analyzed data table;

FIG. 10 is a diagram illustrating an example of a management targetdevice list stored in a device list storage unit;

FIG. 11 is an example of a flowchart illustrating a data collectionprocess procedure by a data collection unit of the node managementapparatus;

FIG. 12 is a diagram illustrating an example of an analyzed data tablestored in the node management apparatus;

FIG. 13 is an example of a flowchart illustrating a data analysisprocess procedure by a data analysis unit of the node managementapparatus;

FIG. 14 is a diagram illustrating a first example of informationregistered in a group data table;

FIG. 15 is a diagram illustrating a second example of informationregistered in a group data table;

FIG. 16 is a diagram illustrating a first example of grouping;

FIG. 17 is a diagram illustrating a second example of grouping;

FIG. 18 is an example of a flowchart illustrating a main groupdetermination process procedure by a management table output unit;

FIG. 19 is an example (part 1) of a flowchart illustrating aninformation display process procedure by the management table outputunit;

FIG. 20 is an example (part 2) of a flowchart illustrating aninformation display process procedure by the management table outputunit;

FIG. 21 is a diagram illustrating a first display example of a grouptable and an asset table;

FIG. 22 is a diagram illustrating a second display example of a grouptable and an asset table;

FIG. 23 is a diagram illustrating a third display example of a grouptable and an asset table;

FIG. 24 is a diagram illustrating a fourth display example of grouptables and an asset table;

FIG. 25 is a diagram illustrating an example of a difference occurrencedetermination process using the number of differences;

FIG. 26 is a diagram illustrating a first example of maintenance work;

FIG. 27 is diagram illustrating a second example of maintenance work;and

FIG. 28 is a diagram illustrating a third example of maintenance work.

DESCRIPTION OF EMBODIMENTS

The following proposals have been made for system management. Forexample, a network management system has been proposed in which a nodeanalyzes the number of hops in network group information to select agroup management apparatus dose to the self-node and form a group,thereby achieving hierarchical management of a network. A computersystem has been proposed in which a manager mechanism is provided tointegrate and manage configuration management information for networkmanagement and configuration management information for systemmanagement, so that device configuration information and programconfiguration information may be collectively managed.

When performing maintenance work on a device included in a computersystem, it is important to specify another device that is estimated tobe greatly affected by the maintenance work in order to improve thereliability of the maintenance work. For example, when performingmaintenance work on a device, it may be better to stop not only theoperation of the device to be subjected to the maintenance work but alsothe operation of another specified device. It may be better not only toperform the maintenance work on the target device but also to performmaintenance work on the other specified device. By stopping theoperation of the other specified device or performing the maintenancework on the other device, it is possible to reduce the possibility thatan abnormality will occur in the system after the maintenance work onthe target device is performed.

However, as the number of management target devices increases and thesystem configuration and the process in the system become morecomplicated, it becomes more difficult to accurately specify a devicethat is estimated to be greatly affected by maintenance work.

In one aspect, a management apparatus, a management system, and amanagement method capable of presenting information for improvingreliability of maintenance work may be provided.

Embodiments of the present disclosure are described below with referenceto the drawings.

First Embodiment

FIG. 1 is a diagram illustrating a configuration example and a processexample of a management apparatus according to a first embodiment. Amanagement apparatus 1 illustrated in FIG. 1 includes a storage unit 2and a processing unit 3. The storage unit 2 is implemented, for example,as a storage area of a storage device (not illustrated) included in themanagement apparatus 1. The processing unit 3 is implemented, forexample, as a processor (not illustrated) included in the datamanagement apparatus 1.

The management apparatus 1 manages a plurality of devices. The pluralityof devices to be managed are, for example, a computer such as a serverdevice and a communication device such as a switch. One of themanagement target devices is capable of communicating with at least oneother management target device. In FIG. 1, devices 11 to 14 areillustrated as the management target devices.

The processing unit 3 collects information from each of the devices 11to 14 based on a history of communication processes executed with theother management target device, and stores the information in thestorage unit 2. For example, based on the history of communicationprocesses executed with the other device, each of the devices 11 to 14creates communication process information 21 indicating thecommunication processes of the same type executed at the same timeintervals with the same communication partner. The processing unit 3collects the communication process information 21 from each of thedevices 11 to 14 as information based on the history, and stores theinformation in the storage unit 2.

Based on the collected information (the communication processinformation 21 in FIG. 1), the processing unit 3 creates a group bycollecting one or more pairs of communication source and communicationdestination devices in which the communication processes of the sametype are executed at the same time intervals. For example, in FIG. 1, itis assumed that the following communication processes 31 and 32 areextracted based on the communication process information 21 stored inthe storage unit 2.

The communication process 31 is a process in which a communicationsource is a device A (device 11), a communication destination is adevice B (device 12), a process classification type is P1, and anexecution interval is 1 hour. The communication process 32 is a processin which the communication source is a device D (device 14), thecommunication destination is the device B (device 12), the processclassification type is P1, and the execution interval is 1 hour. Sincethe process classification types are the same between the communicationprocesses 31 and 32, the process types are considered to be the same,and the execution intervals are also the same, so that the processingunit 3 groups the pair of devices A and B in the communication process31 and the pair of devices D and B in the communication process 32.

The process classification type is information based on, for example,the name of a program and the name of a process to be executed, the nameof a protocol to be used, and the like, and indicates the communicationprocess type. For example, between the communication processes 31 and32, not only when the process classification types are the same, butalso when the process classification types are similar or related, itmay be determined that the process types are the same.

In addition to the process type and the execution interval, for example,a used port number may be used to determine the grouping.

The processing unit 3 outputs display information 41 for displayinginformation of the devices A, B, and D included in the group created bythe above process. The display information 41 is displayed on a displaydevice (not illustrated) and viewed by the administrator.

According to the management apparatus 1 described above, it is possibleto present information for improving the reliability of maintenancework. For example, since the devices A, B, and D included in the groupperform the communication processes of the same type at the same timeintervals, it is estimated that the devices A, B, and D are highlyrelated to each other or highly dependent on each other. For example,when stopping the operation of any one of the devices A, B, and D,unless the operation of the other devices is also stopped, thepossibility that an abnormality occurs in the other devices increases.When updating the program in any one of the devices A, B, and D, unlessthe programs are also updated in the other devices, the possibility thatan abnormality occurs in the other devices increases.

Simply performing communication between a certain device and anotherdevice does not mean that the relevancy and dependency between thesedevices are high. By performing grouping based on the processclassification type and the execution interval, the management apparatus1 may estimate with high accuracy a group of devices having highrelevancy and dependency, in which an abnormality is likely to occurunless some measures are taken during maintenance work.

Therefore, by viewing the display information 41, the administrator maydetermine that the influence of the maintenance work is likely to belarge between the devices A, B, and D. For example, when stopping theoperation of the device A, the administrator may determine that it isbetter to stop the operation of the devices B and D by viewing thedisplay information 41. When updating the program of the device A, theadministrator may determine that it is better to update the programs ofthe devices B and D by viewing the display information 41. By presentingthe display information 41 to the administrator in this way, it ispossible to improve the reliability of the maintenance work by theadministrator.

Second Embodiment

Next, node management in a data center will be described as a secondembodiment.

FIG. 2 is a diagram illustrating a configuration example of aninformation processing system according to the second embodiment. Aninformation processing system 100 illustrated in FIG. 2 is a systemincluding various information processing devices arranged in a datacenter, and includes a node management apparatus 101, nodes N1, N2, N3,N4, . . . to be managed by the node management apparatus 101, and anadministrator terminal 102 coupled to the node management apparatus 101.

The node management apparatus 101 manages the nodes N1, N2, N3, N4, . .. coupled via a network 103. The administrator terminal 102 is aterminal device operated by an administrator who manages the nodes N1,N2, N3, N4, . . . .

Each of the management target nodes N1, N2, N3, N4, . . . is aninformation processing device such as a server device or a communicationdevice (network-related device). For example, as the server device, aWeb server, an application server, a database server, a storage controlserver, or the like may be applied. As the communication device, aswitch, a router, or the like may be applied. Each of the nodes N1, N2,N3, N4, . . . is coupled to at least one of the other management targetnodes via a network.

The network 103 that couples the node management apparatus 101 and thenodes N1, N2, N3, N4, . . . may be the same as the network in whichcommunication between the nodes is performed, or may be provided formanagement only, separate from such a network.

Each of the nodes N1, N2, N3, N4, . . . is provided with a function ofcollecting a history of executed communication processes andtransmitting the history to the node management apparatus 101. The nodemanagement apparatus 101 visualizes the mutual relationship between thenodes based on the information collected from each node. For example, inthe present embodiment, the node management apparatus 101 groupscombinations of nodes that may be greatly affected during maintenancework based on a process name and a used port in communication, acommunication destination, communication periodicity, and the like. Thenode management apparatus 101 displays group information together withnode attribute information on the administrator terminal 102. Whendisplaying the group information, the node management apparatus 101 mayalso indicate a difference between the configuration of a formed groupand the configuration of a group formed in the past. By such a process,the management work by the administrator of the node is made efficientand accurate.

FIG. 3 is a diagram illustrating a hardware configuration example of anode management apparatus. The node management apparatus 101 isimplemented as, for example, a computer as illustrated in FIG. 3.

The node management apparatus 101 illustrated in FIG. 3 includes aprocessor 111, a random-access memory (RAM) 112, a hard disk drive (HDD)113, a graphic interface (I/F) 114, an input interface (I/F) 115, areading device 116, and a communication interface (I/F) 117.

The processor 111 collectively controls the entire node managementapparatus 101. The processor 111 is, for example, a central processingunit (CPU), a microprocessor unit (MPU), a digital signal processor(DSP), an application-specific integrated circuit (ASIC), or aprogrammable logic device (PLD). The processor 111 may also be acombination of two or more elements of the CPU, the MPU, the DSP, theASIC, and the PLD.

The RAM 112 is used as a primary storage device of the node managementapparatus 101. At least part of an operating system (OS) program and anapplication program to be executed by the processor 111 is temporarilystored in the RAM 112. Various kinds of data to be used in processing bythe processor 111 are also stored in the RAM 112.

The HDD 113 is used as an auxiliary storage device of the nodemanagement apparatus 101. The OS program, the application program, andthe various kinds of data are stored in the HDD 113. A different type ofnonvolatile storage device such as a solid-state drive (SSD) may be usedas the auxiliary storage device.

A display device 114 a is coupled to the graphic interface 114. Thegraphic interface 114 displays an image on the display device 114 aaccording to a command from the processor 111. The display device may bea liquid crystal display, an organic electroluminescence (EL) display,or the like.

An input device 115 a is coupled to the input interface 115. The inputinterface 115 transmits a signal outputted from the input device 115 ato the processor 111. The input device 115 a may be a keyboard, apointing device, or the like. The pointing device may be a mouse, atouch panel, a tablet, a touch pad, a track ball, or the like.

A portable recording medium 116 a is removably mounted on the readingdevice 116. The reading device 116 reads data recorded in the portablerecording medium 116 a and transmits the data to the processor 111. Theportable recording medium 116 a may be an optical disk, amagneto-optical disk, a semiconductor memory, or the like.

The communication interface 117 transmits/receives data with otherdevices such as the nodes N1 to N6 via the network 103.

With the above-described hardware configuration, the processing functionof the node management apparatus 101 may be implemented. The managementtarget node may also be implemented as a computer having theconfiguration illustrated in FIG. 3, for example. The node includes, forexample, a processor and has a configuration capable of executingvarious processes by the processor executing an application program orfirmware.

Next, FIG. 4 is a diagram illustrating a comparative example regardingthe creation of an asset information list.

By using, for example, an asset information list 121 in whichinformation about the information processing devices (nodes) in thesystem is registered, the administrator of the information processingsystem 100 may manage these information processing devices. FIG. 4illustrates the asset information list 121 in which information aboutthe management target nodes N1 to N6 is registered. In the assetinformation list 121, an Internet Protocol (IP) address of the node, aserial number of the node, and a function/use are registered inassociation with a node name that identifies each node. Of these, thefunction/use is, for example, information indicating a main role andprocessing content of the node, and is, for example, information basedon a main program name, a process name, an OS name, a protocol to beused, and the like.

For example, the administrator may display the asset information list121 on the administrator terminal 102 and perform maintenance work onthe information processing system 100 while referring to the displaycontent. For example, the administrator refers to the asset informationlist 121 to confirm the information of the node to be operated, and thusmay perform the appropriate operation according to the function/use andthe like of the node.

When the maintenance work is performed on a certain node, themaintenance work may affect other nodes. Therefore, the administrator isdemanded to determine the extent to which the maintenance work willaffect. For example, when the maintenance work of the node N1 isperformed while the communication is performed between the node N1 andthe nodes N3 and N5, the nodes N3 and N5 may not communicate with thenode N1, and thus it may be said that the maintenance work also affectsthe nodes N3 and N5. In this case, the administrator is demanded to stopnot only the operation of the node N1 but also the operation of thenodes N3 and N5 to perform the maintenance work of the node N1.Depending on the work content on the node N1, it may be demanded toperform some work on the nodes N3 and N5.

For example, the administrator may be able to specify the extentaffected by the maintenance work by referring to the content of thefunction/use of the asset information list 121. For example, it isdetermined that nodes having the same content of function/use belong tothe extent of influence.

Such an asset information list 121 is created and updated by, forexample, the operation of the administrator using the administratorterminal 102. The administrator operates the administrator terminal 102to update the content of the asset information list 121, for example,when a node is added, replaced, discarded, or the like. However, thenumber of management target nodes, (information processing devices)tends to increase with an increase in scale of a data center. When thenumber of management target nodes becomes enormous, the work of manuallyupdating the asset information list 121 by the administrator becomescomplicated, and errors in the update work easily occur.

For example, when an error occurs in the updated content of the assetinformation list 121, the extent affected by the maintenance work maynot be accurately specified. As a result, the administrator may not beable to correctly perform the maintenance work, and the system maymalfunction after the maintenance work. When a failure occurs after themaintenance work, the administrator may refer to the asset informationlist 121 to confirm whether there is a difference in the content betweenbefore and after the maintenance work. This is because the difference inthe content may be related to the cause of the failure. However, when anerror occurs in the updated content of the asset information list 121,the administrator may not accurately confirm the difference in thecontent of the asset information list 121 before and after themaintenance work, and may not obtain useful information regarding thecause of the failure.

The content displayed based on the asset information list 121 is notsufficient as the content of information to be referred to formaintenance work. For example, the function/use registered in the assetinformation list 121 alone is not sufficient information for specifyingthe extent affected by the maintenance work and for investigating thecause of the failure after the maintenance work. Therefore, it isdesirable to be able to present more useful information for maintenancework to the administrator.

Although the system appears to operate correctly from the outside, thesystem may actually be abnormal. For example, in a case where theoperation may be continued even when the type or version of softwareinstalled is wrong, the administrator may not notice an abnormalityuntil a specific processing abnormality is found by a user of the systemor the like. Therefore, even in such a case, it is desirable to be ableto present useful information to the administrator so that theadministrator may notice that the system is abnormal.

In the present embodiment, each management target node is provided witha function of periodically collecting communication processing content(history) executed by the node, and the information collected by thiscollecting function is transmitted to the node management apparatus 101.The node management apparatus 101 uses the collected information togroup combinations of nodes that may be affected by the maintenance workbased on a process name and a used port in communication, acommunication destination, a communication periodicity, and the like. Bysuch processing, even when there is a change in the node configuration,the node management apparatus 101 may accurately specify an extent thatmay be affected by the maintenance work and present the nodes belongingto the specified extent to the administrator.

The node management apparatus 101 compares the information of the groupspecified at a certain timing with the information of the groupspecified before, and displays the information indicating the differencetogether with the information of the groups on the administratorterminal 102. Thus, information useful for improving the efficiency andaccuracy of the maintenance work may be presented to the administrator.

FIG. 5 is a diagram illustrating a configuration example of processingfunctions included in a node and a node management apparatus.

The node N1 includes an OS 201, a data collection unit 202, a dataanalysis unit 203, a data transmission unit 204, a collected datastorage unit 210, a classified data storage unit 220, and an analyzeddata storage unit 230.

The process of OS 201 is implemented by a processor (not illustrated)included in the node N1 executing an OS program. The processes of thedata collection unit 202, the data analysis unit 203, and the datatransmission unit 204 are implemented by a processor (not illustrated)included in the node N1 executing a predetermined application program orfirmware program. The collected data storage unit 210, the classifieddata storage unit 220, and the analyzed data storage unit 230 areimplemented as storage areas of a storage device (not illustrated)included in the node N1.

The nodes N2, N3, . . . also have similar processing functions to thenode N1.

The node management apparatus 101 includes a data collection unit 131, adata analysis unit 132, a management table output unit 133, a devicelist storage unit 140, an analyzed data storage unit 150, and a groupdata storage unit 160.

The processes of the data collection unit 131, the data analysis unit132, and the management table output unit 133 are implemented by theprocessor 111 executing a predetermined program. The device list storageunit 140, the analyzed data storage unit 150, and the group data storageunit 160 are implemented as storage areas of storage devices such as theRAM 112 and the HDD 113 included in the node management apparatus 101.

First, the processes of the OS 201 and the data collection unit 202 ofthe node will be described. The OS 201 manages processes executed in thenode, such as a communication process. The OS 201 has a function ofoutputting information indicating a communication state. The datacollection unit 202 periodically collects the content of thecommunication process executed in the node by using this function of theOS 201. The data collection unit 202 registers the collected informationin a collected data table stored in the collected data storage unit 210.

FIG. 6 is a diagram for explaining an example of a data collectionprocess by the data collection unit.

For example, in Windows (registered trademark) or Linux (registeredtrademark), information indicating a communication state may be acquiredby using a netstat command. Output information 201 a illustrated in FIG.6 is an example of information outputted from the OS 201 to the datacollection unit 202 when the data collection unit 202 requestsinformation indicating a communication state by the netstat command in acase where the OS 201 is Linux.

The output information 201 a includes a record for each connection, andeach record includes each item of Local Address, Foreign Address, State,and PID/Program name. In the item of Local Address, an IP address and aused port of a local computer (node itself) are described. In the itemof Foreign Address, an IP address of a communication destination(coupling destination) and a port number of a used port are described.In the item of State, a state of the connection is described. In theitem of PID/Program name, a process ID for identifying a communicationprocess and a program name indicating a program for executing thecommunication process are described.

On the other hand, the collected data table 211 stored in the collecteddata storage unit 210 includes each item of a timestamp, communicationsource information, communication destination information, acommunication state, and a process name.

The timestamp indicates the time at which the data was collected. Thecommunication source information indicates an IP address of acommunication source (node itself) and a port number of a used port(standby port). In the item of communication source information, theinformation described in the item of Local Address in the outputinformation 201 a is registered. The communication destinationinformation indicates an IP address of a communication destination and aport number of a used port. In the item of communication destinationinformation, the information described in the item of Foreign Address inthe output information 201 a is registered.

The communication state indicates a state of communication in theconnection. In the item of communication state, the informationdescribed in the item of State in the output information 201 a isregistered. The process name indicates a process name for identifying acommunication process using the connection. In the item of the processname, the information described in the item of PID/Program name in theoutput information 201 a is registered. This information indicates acommunication process executed by the communication source device usingthe corresponding connection.

The data collection unit 202 periodically issues a command forrequesting information indicating a communication state to the OS 201 atregular time intervals, collects the information, and accumulates thecontent of the collected information in the collected data table 211. Inthis way, the data collection unit 202 may periodically collect andaccumulate the content of the communication process executed in the node(in the example of FIG. 6, information about the connection whosecommunication state is “ESTABLISHED”).

Hereinafter, an execution cycle of data collection (collection cycle) bythe data collection unit 202 is referred to as T1, and a period of aunit time “T1” is referred to as a “unit collection period”. In thepresent embodiment, as an example, T1=5 seconds.

FIG. 7 is an example of a flowchart illustrating a data collectionprocess procedure.

[Step S11] The data collection unit 202 acquires a timestamp (currenttime). The timestamp is information in seconds so that the informationcollected every 5 seconds may be identified.

[Step S12] The data collection unit 202 executes a state confirmationcommand (for example, the netstat command) to request the OS 201 tooutput information indicating the communication state.

[Step S13] The data collection unit 202 waits for a predetermined time(T1=5 seconds in this case).

[Step S14] The data collection unit 202 acquires information indicatingthe communication state in the latest 5 seconds from the OS 201. Thedata collection unit 202 registers the collected data together with thetimestamp acquired in step S11 in the collected data table 211 in thecollected data storage unit 210. As illustrated in FIG. 6, in thecollected data table 211, information indicating the communication stateis registered for each connection. Thereafter, the process proceeds tostep S11.

As described above, by executing the process of steps S11 to S14 once,the data collected by the data collection unit 202 in the latest unitcollection period is accumulated in the collected data storage unit 210.By repeatedly executing the process of steps S11 to S14, the collecteddata for each unit collection period is sequentially accumulated in thecollected data storage unit 210.

Next, processes of the data analysis unit 203 and the data transmissionunit 204 of the node will be described. The data analysis unit 203analyzes the data collected by the data collection unit 202 andaccumulated in the collected data storage unit 210, and stores theanalysis result in the analyzed data storage unit 230. In this analysis,the data analysis unit 203 classifies the information about the executedcommunication process based on the process name, the port numbers of thecommunication source and the communication destination, and the IPaddress of the communication destination. Data indicating each of theclassified information groups is temporarily stored in the classifieddata storage unit 220 as a classified data file. The data analysis unit203 analyzes the regularity of the execution of the communicationprocesses based on the data accumulated in the classified data storageunit 220, and registers the information of regular communicationprocesses in the analyzed data storage unit 230.

As illustrated in FIGS. 6 and 7, a timestamp indicating the same time isadded to the data collected by the data collection unit 202 in one unitcollection period. Therefore, the collection cycle T1 is the minimumcycle at which the regularity (periodicity) of the execution of thecommunication processes may be determined by the data analysis unit 203.

On the other hand, when the maximum cycle at which the regularity of theexecution of the communication processes (maximum determination cycle)may be determined by the data analysis unit 203 is T2, the data analysisunit 203 determines the regularity by using the data collected by thedata collection unit 202 in the latest period of time equal to or longerthan “T2×2”. In principle, T2 may be equal to or longer than T1, but T2is set to a value longer than T1 so that the periodicity of theexecution of the communication process may be determined for a pluralityof different periods.

In the following description, it is assumed that T1=5 seconds and T2=1day. In this case, the data analysis unit 203 analyzes the regularity ofthe execution of the communication processes by using the data collectedand stored in the latest 3 days (≥T2×2) among the collected data storedin the collected data storage unit 210.

FIG. 8 is an example of a flowchart illustrating a data analysis processprocedure by the data analysis unit. The process of FIG. 8 isperiodically executed at time intervals of T1 or more. In the presentembodiment, it is assumed that the process of FIG. 8 is executed every 1day (24 hours).

[Step S21] The data analysis unit 203 specifies, from the recordsregistered in the collected data table 211 of the collected data storageunit 210, records registered in the latest 3 days (72 hours) based onthe timestamps. The data analysis unit 203 extracts records in whichcommunication is being executed from the specified records. In thisprocess, for example, records related to the connection whosecommunication state is “ESTABLISHED” are extracted.

[Step S22] The data analysis unit 203 classifies the extracted recordsbased on the IP addresses registered in the communication destinationinformation. As a result, records having the same IP address of thecommunication destination registered in the communication destinationinformation are classified into the same group.

[Step S23] For each of the classified groups, the data analysis unit 203further classifies the records in the group based on the port numbersregistered in the communication source information and the communicationdestination information. As a result, records having the same IP addressof the communication destination and the same port numbers used at thecommunication source and the communication destination are classifiedinto the same group.

Records having the same port number of either the communication sourceor the communication destination may be grouped. However, since thecombination of the port numbers of the communication source and thecommunication destination is the same in the connection in which thetype of the communication process is the same, it is desirable that therecords in which the port numbers used in the communication source andthe communication destination are the same be classified into the samegroup as described above.

[Step S24] The data analysis unit 203 furthermore classifies the recordsin each of the classified groups based on the process names. As aresult, records having the same IP address of the communicationdestination, the same port numbers used at the communication source andthe communication destination, and the same process name executed by thetransmission source are classified into the same group.

[Step S25] The data analysis unit 203 creates a classified data file foreach classified group, and stores the created classified data files inthe classified data storage unit 220. At this time, in each classifieddata file, the process name, the communication destination address (IPaddress), and the port numbers described in the records included in thegroup are described. In the classified data file, all the timestampsdescribed in the records included in the group are described. As aresult, in the classified data file, the execution histories about thecommunication processes having the same process name, communicationdestination address, and port numbers in the latest 3 days are recorded.

[Step S26] The data analysis unit 203 extracts information of regularcommunication processes based on the classified data file stored in theclassified data storage unit 220. In this process, the data analysisunit 203 determines, for each classified data file, whether thecommunication processes have been performed periodically based on thetimestamps. When a plurality of communication processes having equalexecution intervals are found, those communication processes areextracted as regular communication processes.

For a communication process whose execution interval is less than 12hours, the determination is performed using only timestamps indicating atime within the latest 1 day among timestamps described in theclassified data file. For a communication process whose executioninterval is equal to or more than 12 hours and less than 24 hours, thedetermination is performed using only timestamps indicating a timewithin the latest 2 days among timestamps described in the classifieddata file. For a communication process whose execution interval is 24hours (1 day), the determination is performed using timestampsindicating times within the latest 3 days among timestamps described inthe classified data file (for example, using all timestamps in theclassified data file).

Even in a regular communication process, since a deviation may occur inthe execution cycle due to re-execution or the like caused by acommunication error, the determination is performed in consideration ofthe deviation in the execution cycle. For example, in a case ofdetermining a communication process having an execution cycle of lessthan 10 minutes, when the deviation of the execution cycle is within ±5seconds, it is determined as a regular communication process. In a caseof determining a communication process having an execution cycle of 1hour, when the deviation of the execution cycle is within ±2 minutes, itis determined as a regular communication process. In a case ofdetermining a communication process having an execution cycle of 1 day(24 hours), when the deviation of the execution cycle is within ±30minutes, it is determined as a regular communication process.

[Step S27] The data analysis unit 203 creates an analyzed data table towhich a timestamp of the current time is added, and stores the analyzeddata table in the analyzed data storage unit 230. When the regularcommunication process is extracted in step S26, the data analysis unit203 registers the communication source address, the communicationdestination address, and the process name of the communication process,together with the time indicating the execution interval, in one recordin the created analyzed data table.

A plurality of regular communication processes having differentexecution cycles may be extracted from one classified data file. In thiscase, the information of each communication process is registered in aseparate record in the analyzed data table.

[Step S28] The data analysis unit 203 clears (deletes) all theclassified data files stored in the classified data storage unit 220.The classified data storage unit 220 is used as a work area in the dataanalysis process by the collected data storage unit 210.

FIG. 9 is a diagram illustrating an example of classified data files andan analyzed data table.

In FIG. 9, classified data files 221 a and 221 b are illustrated asexamples of the classified data files created in step S25 of FIG. 8. Asin this example, a process name, a communication destination address,port numbers, and a plurality of timestamps are described in theclassified data file. The timestamp indicates a time at which acommunication process having the same process name, communicationdestination address, and port numbers is executed.

On the other hand, in the analyzed data table 231 stored in the analyzeddata storage unit 230, as illustrated in FIG. 9, a timestamp is added,and a record having each item of a communication source address, acommunication destination address, a process name, and an executioninterval is also registered. As the item of the communication sourceaddress, the IP address of the node on which the data analysis processis executed is registered. In each of the items of the communicationdestination address, the process name, and the execution interval,information related to a regular communication process extracted fromone classified data file is registered.

The classified data files 221 a and 221 b and the analyzed data table231 illustrated in FIG. 9 are created by the data analysis processexecuted on Dec. 12, 2019.

In the classified data file 221 a, the process name “ftp.exe”, thecommunication destination address “5.5.5.5”, and the port numbers“22,55” (the port number of the communication source is “22” and theport number of the communication destination is “55”) are described. Inthe classified data file 221 a, timestamps (execution times) of 1:45:55on Dec. 10, 2019, 1:51:20 on Dec. 11, 2019, and 1:50:5 on Dec. 12, 2019are described. In this case, the data analysis unit 132 determines thatthe communication processes at one-day intervals are being executed, andregisters a record of the communication process in the analyzed datatable 231. In this record, a communication source address “1.1.1.1”, acommunication destination address “5.5.5.5”, a process name “ftp.exe”,and an execution interval “1 day” are registered.

In the classified data file 221 b, a process name “ftp.exe”, acommunication destination address “6.6.6.6”, and port numbers “22,55”are described. In the classified data file 221 b, timestamps (executiontimes) of 1:46:5 on Dec. 10, 2019, 1:52:40 on Dec. 11, 2019, and 1:51:35on Dec. 12, 2019 are described. In this case, the data analysis unit 132determines that the communication processes at one-day intervals arebeing executed, and registers a record of the communication process inthe analyzed data table 231. In this record, a communication sourceaddress “1.1.1.1”, a communication destination address “6.6.6.6”, aprocess name “ftp.exe”, and an execution interval “1 day” areregistered.

Each record in the analyzed data table 231 may further include an itemof the port numbers. In this case, the port numbers described in theclassified data file are registered in the item of port numbers.

As described above, the analyzed data storage unit 230 stores theanalyzed data table 231 indicating the analysis result analyzed on thedata analysis date indicated by the timestamp. The data transmissionunit 204 transmits, in response to a request from the node managementapparatus 101, the content of the analyzed data table 231 stored in theanalyzed data storage unit 230 to the node management apparatus 101.

Next, the node management apparatus 101 will be described.

FIG. 10 is a diagram illustrating an example of a management targetdevice list stored in a device list storage unit. The device liststorage unit 140 stores a management target device list 141 asillustrated in FIG. 10. Information about each node to be managed by thenode management apparatus 101 is registered in the management targetdevice list 141.

The management target device list 141 includes a record corresponding toeach management target node. Each record includes each item of an IPaddress, a serial number, an OS classification type, a login ID, and apassword.

The IP address indicates an IP address assigned to a node. The serialnumber indicates a serial number (such as a manufacturing number)assigned to a node. The OS classification type indicates an OSclassification type executed in a node. The login ID and the passwordare information used to log in to a node in order to acquire an analysisresult from the node. The login ID indicates identification informationon the administrator side for logging in to the node. The passwordindicates a password to be entered to log in to the node.

The management target device list 141 may be updated each time theconfiguration of the node changes, in response to input operation by theadministrator. However, in order to accurately manage the nodes, it isdesirable that the data be automatically collected from each node by thedata collection unit 131 of the node management apparatus 101. As acollection method, for example, a method defined by the Simple NetworkManagement Protocol (SNMP) or the Secure SHell (SSH) may be used.

The data collection unit 131 refers to the management target device list141 to recognize management target nodes, and periodically collects ananalysis result from each node. The collected analysis results areregistered in the analyzed data table of the analyzed data storage unit150.

FIG. 11 is an example of a flowchart illustrating a data collectionprocess procedure by a data collection unit of the node managementapparatus. It is assumed that the process of FIG. 11 is executed every 1day (24 hours), which is the same as the execution cycle of the dataanalysis process in each node.

[Step S31] The data collection unit 131 creates an analyzed data tableand stores the analyzed data table in the analyzed data storage unit150. A timestamp indicating the current date and time is added to thecreated analyzed data table. In the present embodiment, since the datacollection and data analysis by the node management apparatus 101 areexecuted at 1-day intervals, the current date is added as a timestamp.

[Step S32] The data collection unit 131 refers to the management targetdevice list 141 and selects one management target node. The datacollection unit 131 reads information for logging in to the selectednode from the record of the selected node. For example, the IP address,the login ID, and the password are read.

[Step S33] The data collection unit 131 logs in to the node by using theread information and requests transmission of the analysis result. Inthe node, the data transmission unit 204 accepts the transmissionrequest, reads information of each record in the analyzed data table 231created in the latest data analysis process from the analyzed datastorage unit 230, and transmits the information to the node managementapparatus 101.

[Step S34] The data collection unit 131 receives the information of therecord in the analyzed data table 231 (for example, the analysis result)transmitted from the node. The data collection unit 131 registers thereceived information of each record in each record in the analyzed datatable created in step S31. As a result, each record of the node in theanalyzed data table 231 is copied to the analyzed data table of the nodemanagement apparatus 101.

[Step S35] The data collection unit 131 determines whether allmanagement target nodes have been selected. When there are unselectednodes, the data collection unit 131 advances the process to step S32,selects one of the unselected nodes, and continues the process. On theother hand, when all the management target nodes have been selected, thedata collection unit 131 ends the data collection process.

Through the above process, each record in the latest analyzed data table231 created in each management target node is copied to the newlycreated analyzed data table.

FIG. 12 is a diagram illustrating an example of an analyzed data tablestored in the node management apparatus. An analyzed data table 151illustrated in FIG. 12 is stored in the analyzed data storage unit 150.

As illustrated in FIG. 12, a timestamp indicating the date and time ofdata collection and data analysis is added to the analyzed data table151. In the example of FIG. 12, a timestamp indicating Dec. 12, 2019 isadded. Similar to the analyzed data table 231 of the node, each recordin the analyzed data table 151 includes each item of a communicationsource address, a communication destination address, a process name, andan execution interval. When the analyzed data table 231 of the nodeincludes the item of the port numbers, the analyzed data table 151 alsoincludes the item of the port numbers.

The data analysis unit 132 uses the one analyzed data table 151 createdas described above to group nodes, each performing the same type ofcommunication with similar regularity. In this grouping, nodes, eachperforming communication having the same communication source orcommunication destination, the same execution interval, and the same orrelated process name, are classified into one group together withinformation indicating the content of the communication. Thisclassification process is performed by grouping the records in theanalyzed data table 151, and the grouped records are registered in agroup data table of the group data storage unit 160 in a state in whichthe groups may be identified.

FIG. 13 is an example of a flowchart illustrating a data analysisprocess procedure by a data analysis unit of the node managementapparatus.

[Step S41] The data analysis unit 132 refers to the latest analyzed datatable 151 stored in the analyzed data storage unit 150, and classifiesthe records in the analyzed data table 151 based on the process names.

[Step S42] For each of the classified record groups, the data analysisunit 132 groups records having the same communication source or the samecommunication destination, and the same execution interval of therecords included in the record group.

[Step S43] The data analysis unit 132 selects one group classified instep S42.

[Step S44] The data analysis unit 132 determines a representative nodefrom the nodes registered in the records included in the selected group.For example, the node having the largest number of registrations in theitems of the communication source address and the communicationdestination address is determined as the representative node.

[Step S45] The data analysis unit 132 adds the IP address(representative address) of the determined representative node and thetimestamp added to the analyzed data table 151 of the referencedestination (date in this example) to the information of the recordincluded in the selected group, and registers the information in thegroup data table. In the group data table, a record corresponding toeach record included in the group is created.

[Step S46] The data analysis unit 132 determines whether all classifiedgroups have been selected. When there are unselected groups, the dataanalysis unit 132 advances the process to step S43, selects oneunselected group, and continues the process. On the other hand, when allthe groups have been selected, the data analysis unit 132 ends the dataanalysis process.

FIG. 14 is a diagram illustrating a first example of informationregistered in a group data table. A group data table 161 includes eachitem of a communication source address, a communication destinationaddress, a process name, an execution interval, a representativeaddress, a date, and a main identifier.

Among these items, in each of the items of the communication sourceaddress, the communication destination address, the process name, andthe execution interval, the data in the same name item in the analyzeddata table 151 is registered. The address of the representative nodedetermined in step S44 of FIG. 13 is registered in the item of therepresentative address. The timestamp added to the analyzed data table151 of the reference destination is registered in the item of the date.This date indicates the date on which the group was created by the dataanalysis. In the group data table 161, among the registered records,records having the same process name, execution interval, representativeaddress, and date are identified as records belonging to the same group.

When the group to which the records belong is a main group (describedlater) for a certain node, the IP address of the node is registered inthe item of the main identifier. In the item of the main identifier, anIP address is not registered in an initial state (for example, NULL isregistered).

FIG. 14 illustrates a case where grouping is performed in accordancewith a first grouping rule in steps S41 and S42 of FIG. 13. According tothe first grouping rule, among the records in the analyzed data table151, records with matching process names, matching either communicationsources or communication destinations, and matching execution intervalsare grouped.

For example, in FIG. 14, records R1 to R3 in which the communicationsource address is “1.1.1.1”, the process name is “ftp.exe”, and theexecution interval is “1 day” are classified into one group. Records R4and R5 in which the communication source address is “2.2.2.2”, theprocess name is “ftp.exe”, and the execution interval is “60 minutes”are classified into another group. Records R6 and R7 in which thecommunication source address is “7.7.7.7”, the process name is“httpd.exe”, and the execution interval is “5 seconds” are classifiedinto still another group.

FIG. 15 is a diagram illustrating a second example of informationregistered in a group data table. FIG. 15 illustrates a case wheregrouping is performed in accordance with a second grouping rule in stepsS41 and S42 of FIG. 13. In the second grouping rule, among the groupsclassified according to the first grouping rule, groups in which processnames are related, the execution interval is the same, andcorrespondence relationships between communication sources andcommunication destinations are reversed are integrated into one group.“Process names are related” means that the respective process names areprocess names that form a pair in a communication process, for example,a requester side process and a standby side process for communication.

For example, in FIG. 15, according to the first grouping rule, therecords R11 to R13 are classified into one group (referred to as a firstgroup), and the records R14 to R16 are classified into another group(referred to as a second group). Between these groups, the process name“ftpd.exe” of the first group is the name of the standby processcorresponding to the process name “ftp.exe” of the second group. Thecorrespondence relationship between the communication source address andthe communication destination address is reversed between the firstgroup and the second group. Therefore, the first group and the secondgroup are integrated, and the records R11 to R16 are classified into thesame group.

Through the above-described process by the data analysis unit 132, therecords indicating the highly relevant communication processes aregrouped. The node group registered as the communication source and thecommunication destination in one record is a node group in which highlyrelevant communication processes are being executed, and is estimated tobe a node group that may be significantly affected by the maintenancework. For example, in this node group, the communication processes ofthe same type are executed at the same execution interval usingduplicate nodes. Therefore, when maintenance work is performed on onenode in the node group, an error in communication process may occur inother nodes in the node group. When the program is updated in one nodein the node group, it is often demanded to update the programs in othernodes in the node group.

Therefore, the management table output unit 133 displays the informationabout the nodes and the communication processes in the group on theadministrator terminal 102, so that it is possible to accuratelypresent, to the administrator, a plurality of nodes that may be greatlyaffected by the maintenance work. For example, in the data analysis, thenodes are grouped based on the type of the communication process and theexecution interval, instead of simply grouping the nodes with whichcommunication has been performed. As a result, it is possible toestimate with high accuracy a group of nodes having high relevancy ordependency that may demand some measures during maintenance work.

By viewing the information displayed in this way, the administrator mayeasily and reliably specify a plurality of nodes that may be greatlyaffected by the maintenance work. Accordingly, the administrator mayperform maintenance work with higher reliability. The administrator mayeasily specify a node that is demanded to confirm whether or not anabnormality has occurred.

The node management apparatus 101 may also use the information of thegroup classified by the data analysis unit 132 for node control. Forexample, when maintenance work is performed on a certain node, the nodemanagement apparatus 101 may specify a group including the node andautomatically stop the operation of each node included in the specifiedgroup. As a result, it is possible to reduce the possibility that anabnormality occurs in the node due to the influence of the maintenancework.

A specific example of grouping will be described.

FIG. 16 is a diagram illustrating a first example of grouping.

FIG. 16 illustrates a case where a node N1 operates as a backup serverand nodes N2 and N3 operate as clients to the backup server. In each ofthe nodes N2 and N3, a process “ftp.exe” that communicates using a port20 operates, and in the node N1, a process “ftpd.exe” that is a standbyprocess for the process “ftp.exe” operates. The process “ftpd.exe”performs communication using a port 20. It is assumed that File TransferProtocol (FTP) communication for a backup process is periodicallyexecuted between the process “ftp.exe” of each of the nodes N2 and N3and the process “ftpd.exe” of the node N1.

In a user terminal 300, a process “sshd.exe” that performs communicationusing a port 22 operates, and in the node N1, a process “sshd.exe” thatperforms communication using a port 22 operates. It is assumed that SSHcommunication is executed between the process “sshd.exe” of the userterminal 300 and the process “sshd.exe” of the node N1. However, the SSHcommunication is executed at irregular timing.

In such a case, the processes “ftp.exe” of the nodes N2 and N3 and theprocess “ftpd.exe” of the node N1 are grouped. In FIG. 16, this group isillustrated as an “FTP group”. On the other hand, the process “sshd.exe”of the node N1 is not included in the group because regularcommunication is not performed.

As described above, in the case of FIG. 16, the information of the groupto which the processes “ftp.exe” of the nodes N2 and N3 and the process“ftpd.exe” of the node N1 belong is displayed on the administratorterminal 102, so the administrator may specify the nodes N1, N2, and N3as the nodes that may be greatly affected by the maintenance work.

FIG. 17 is a diagram illustrating a second example of grouping. In FIG.17, it is assumed that the maintenance work is performed in the state ofFIG. 16, and the process for the FTP communication, which operates inthe node N3, is changed from the process “ftp.exe” to a process“sftp.exe”. It is assumed that FTP communication is performed betweenthe process “sftp.exe” of the node N3 and the process “ftpd.exe” of thenode N1 at the same time interval by using the same port as the FTPcommunication between the process “ftp.exe” of the node N2 and theprocess “ftpd.exe” of the node N1.

When the node management apparatus 101 collects and analyzes data aftera predetermined time from the execution of the maintenance work, theprocess “ftp.exe” of the node N2 and the process “ftpd.exe” of the nodeN1 are grouped as the “FTP group”. On the other hand, this group doesnot include the process “sftp.exe” of the node N3. Actually, the process“sftp.exe” of the node N3 and the process “ftpd.exe” of the node N1 areclassified into a different group.

After the maintenance work, when the information of the group includingthe process “ftp.exe” of the node N2 and the process “ftpd.exe” of thenode N1 is displayed on the administrator terminal 102, displaying thatthe node N3 is removed from this group is also useful for theconfirmation work by the administrator. For example, when a programcorresponding to the process “sftp.exe” is erroneously installed in thenode N3 by maintenance work, displaying that the node N3 is removed fromthe group as described above may remind the administrator that the nodeN3 does not operate as intended.

Although not illustrated, for example, even when the operation of theprocess “ftp.exe” of the node N3 is stopped due to an abnormality in thestate illustrated in FIG. 16, the process “ftp.exe” of the node N3 isremoved from the “FTP group” in the same manner as in FIG. 17 when thenode management apparatus 101 collects and analyzes the data thereafter.For example, when the process “ftp.exe” of the node N3 does not performperiodic communication due to an abnormality in the state of FIG. 16(for example, when the communication execution interval becomesirregular), the process “ftp.exe” of the node N3 is removed from the“FTP group” as in FIG. 17. Even in such a case, by displaying that thenode N3 is removed from the group that includes the process “ftp.exe” ofthe node N2 and the process “ftpd.exe” of the node N1, the administratormay notice that an abnormality has occurred in the node N3.

Although an abnormality occurs in the operation of the process “ftp.exe”of the node N3 after the maintenance work, the abnormality does notappear in appearance in some cases. Even in this case, by displayingthat the node N3 is removed from the group that includes the process“ftp.exe” of the node N2 and the process “ftpd.exe” of the node N1, theadministrator may be able to notice that an abnormality has occurred inthe node N3.

Thus, the management table output unit 133 of the node managementapparatus 101 not only displays the information of the group obtained bythe latest data analysis by the data analysis unit 132 on theadministrator terminal 102, but also simultaneously displays theinformation indicating a difference with the group created by the pastdata analysis. Hereinafter, a group created by the latest data analysisis referred to as a “current group”, and a group created by a previousdata analysis is referred to as a “past group”. A group created by dataanalysis 1 day before the latest data analysis is referred to as a“previous group”.

In the present embodiment, as an example, the management table outputunit 133 determines a “main group” indicating a group in which a maincommunication process is performed for each node in order to specify apair to be compared between the current group and the past group. Themanagement table output unit 133, when displaying the information of thegroup to which a certain node belongs on the administrator terminal 102,compares a main group of the current group to which the node belongswith a main group of the past group to which the node belongs. Themanagement table output unit 133 displays information indicating adifference between the main groups on the administrator terminal 102.

FIG. 18 is an example of a flowchart illustrating a main groupdetermination process procedure by the management table output unit. Theprocess of FIG. 18 may be continuously executed, for example, when thedata analysis process of FIG. 13 by the data analysis unit 132 iscompleted.

[Step S51] The management table output unit 133 refers to the managementtarget device list 141 stored in the device list storage unit 140 andselects one management target node.

[Step S52] The management table output unit 133 specifies all groups towhich the selected node belongs from the latest group data table 161.

[Step S53] The management table output unit 133 narrows down thespecified groups to groups having the largest number of coupled nodes(nodes belonging to the group). The reason why the groups are narroweddown to the groups having the largest number of coupled nodes is that itis considered that the number of nodes in which the same types ofcommunication are executed is large and that the extent affected by themaintenance work is the widest.

[Step S54] When the groups are narrowed down to a plurality of groups instep S53, the management table output unit 133 further narrows down thenarrowed down groups to a group having the shortest execution interval.The reason why the groups are narrowed down to the group having theshortest execution interval is that the higher the execution frequencyof communication is, the higher the relevancy between the nodes is.

[Step S55] The one group narrowed down in steps S53 and S54 is set as amain group corresponding to the selected node. The management tableoutput unit 133 registers the IP address of the selected node in theitem of the main identifier of each record corresponding to the maingroup of the records in the group data table 161. IP addresses of aplurality of nodes may be registered in the main identifier item.

[Step S56] The management table output unit 133 determines whether allmanagement target nodes have been selected. When there are unselectednodes, the management table output unit 133 advances the process to stepS51, selects one of the unselected nodes, and continues the process. Onthe other hand, when all the management target nodes have been selected,the management table output unit 133 ends the main group determinationprocess.

Through the above process, the main group is determined for each node.The main group is determined for each data analysis process by the dataanalysis unit 132 (for example, for each group data table 161).

FIGS. 19 and 20 are examples of flowcharts illustrating an informationdisplay process procedure by the management table output unit.

[Step S61] The management table output unit 133 accepts a nodedesignation from the administrator via the administrator terminal 102.For example, a node on which the administrator is going to performmaintenance work, a node on which the maintenance work has beencompleted, or a node that the administrator thinks is related to thesenodes is designated by the operation of the administrator.

[Step S62] The management table output unit 133 specifies a main groupcorresponding to the designated node from the current group. In thisprocess, the group data table 161 indicating the latest timestamp isreferred to, and the group in which the IP address of the designatednode is registered in the item of the main identifier is specified asthe main group. Hereinafter, the specified main group is referred to asa “main group (1)”, and the referred group data table 161 is referred toas a “group data table (1)”.

[Step S63] The management table output unit 133 specifies a main groupcorresponding to the designated node from the previous group. In thisprocess, the group data table 161 in which the timestamp indicates thesecond latest date is referenced, and the group in which the IP addressof the designated node is registered in the item of the main identifieris specified as the main group. Hereinafter, the specified main group isreferred to as a “main group (2)”, and the referenced group data table161 is referred to as a “group data table (2)”.

[Step S64] The management table output unit 133 determines whether thenode designated in step S61 is a node newly added to the system. Whenthe main group (2) may not be specified in step S63, it is determinedthat the designated node is a newly added node. When it is determinedthat the node is a newly added node, the management table output unit133 advances the process to step S82 in FIG. 20, and when it isdetermined that the node is not newly added node, advances the processto step S65.

[Step S65] The management table output unit 133 determines whether thecontent of the main group (1) is the same as the content of the maingroup (2). In this determination, the content of each record belongingto the main group (1) in the group data table (1) is compared with thecontent of each record belonging to the main group (2) in the group datatable (2). When the pieces of content of the respective groups arecompletely the same, the management table output unit 133 advances theprocess to step S66, and when at least parts of the pieces of content ofthe respective groups are different, advances the process to step S68.

[Step S66] The management table output unit 133 creates an asset tablefor each node included in the main group (1). In this process, themanagement target device list 141 of the device list storage unit 140 isreferenced, information (IP address, serial number, OS classificationtype, login ID, and password) for each node is read, and an asset tablethat displays a list of these pieces of information is created.

[Step S67] The management table output unit 133 creates a group tableindicating information of the main group (1) based on the group datatable (1). The management table output unit 133 displays the createdgroup table together with the asset table created in step S66 on thedisplay device of the administrator terminal 102.

FIG. 21 is a diagram illustrating a first display example of a grouptable and an asset table. In step S67 of FIG. 19, for example, a grouptable 171 a and an asset table 172 a as illustrated in FIG. 21 aredisplayed on the display device of the administrator terminal 102.

In the group table 171 a illustrated in FIG. 21, information of a groupidentified by a process name “ftp.exe”, an execution interval “1 day”, arepresentative address “1.1.1.1”, and a date “20191212” is displayed. Asthe group information, information of each record belonging to the groupregistered in the group data table (1) is displayed in a list.

The case where step S67 is executed is a case where the configuration ofthe current group has not changed from the previous group. For example,it has not changed from the previous data analysis that the nodesindicated by the IP addresses “1.1.1.1”, “5.5.5.5”, “6.6.6.6”, and“7.7.7.7” are included in the above group. In this case, in the grouptable 171 a, only the information of each record belonging to the groupis displayed in a list, and the information indicating a difference isnot displayed.

In the asset table 172 a, information about each node displayed in thegroup table 171 a is extracted from the management target device list141 and displayed.

The case where such a group table 171 a and an asset table 172 a aredisplayed is a case where one of the nodes indicated by the IP addresses“1.1.1.1”, “5.5.5.5”, “6.6.6.6”, and “7.7.7.7” is designated in step S61of FIG. 19.

For example, the administrator displays the group table 171 a asillustrated in FIG. 21 before performing maintenance work of the nodeindicated by the IP address “7.7.7.7”. Accordingly, the administratormay easily and accurately specify the nodes indicated by the IPaddresses “1.1.1.1”, “5.5.5.5”, and “6.6.6.6” as other nodes that may begreatly affected by the maintenance work of the node indicated by the IPaddress “7.7.7.7”.

The description will be continued below with reference to FIG. 19.

[Step S68] The management table output unit 133 determines whether theprocess name and the execution interval of the main group (1) are thesame as the process name and the execution interval of the main group(2). When the management table output unit 133 determines that theprocess name and the execution interval are the same, the processproceeds to step S69. When the management table output unit 133determines that the process name and the execution interval are not thesame (when the content of at least one of the items is different), theprocess proceeds to step S81 in FIG. 20.

[Step S69] The management table output unit 133 creates a group tableincluding difference information.

[Step S70] The management table output unit 133 creates an asset tablethat displays a list of information about each node included in thecreated group table.

[Step S71] The management table output unit 133 displays the group tablecreated in step S69 together with the asset table created in step S70 onthe display device of the administrator terminal 102.

The process of steps S69 to S71 will be described with reference toFIGS. 22 and 23. Cases in which steps S69 to S71 are executed are a casein which a node is added to a certain group and a case in which a nodeis deleted from a certain group. An example of the former case isillustrated in FIG. 22, and an example of the latter case is illustratedin FIG. 23.

FIG. 22 is a diagram illustrating a second display example of a grouptable and an asset table.

In a group table 171 b illustrated in FIG. 22, information of a groupidentified by a process name “ftp.exe”, an execution interval “1 day”, arepresentative address “1.1.1.1”, and a date “20191212” is displayed. Inthe group table 171 b, a record R21 including a communication sourceaddress “1.1.1.1” and a communication destination address “8.8.8.8” isdisplayed surrounded by a thick line as a record indicating the addedcommunication process. For example, the record R21 corresponds to thedifference information. In the item of the difference of the record R21,character information indicating that the record R21 has been added (thecommunication process indicated by the record R21 has been added) isdisplayed.

In the case of FIG. 22, a node indicated by an IP address “8.8.8.8” isadded to a group including nodes indicated by IP addresses “1.1.1.1”,“5.5.5.5”, “6.6.6.6”, and “7.7.7.7”. In this case, in the process ofFIG. 19, the group including the nodes indicated by IP addresses“1.1.1.1”, “5.5.5.5”, “6.6.6.6”, and “7.7.7.7” is specified as the maingroup (2). The group including the nodes indicated by IP addresses“1.1.1.1”, “5.5.5.5”, “6.6.6.6”, “7.7.7.7”, and “8.8.8.8” is specifiedas the main group (1). However, in step S61, any of the nodes indicatedby the IP addresses “1.1.1.1”, “5.5.5.5”, “6.6.6.6”, and “7.7.7.7” isdesignated.

In step S69, the information of the record that is the record in themain group (1) but is not included in the main group (2) (record thatincludes the communication source address “1.1.1.1” and thecommunication destination address “8.8.8.8”) is displayed in the grouptable 171 b as difference information. In step S70, information abouteach node included in such a group table 171 b is read from themanagement target device list 141 of the device list storage unit 140and displayed in the asset table 172 b.

In the example of FIG. 22, the group table 171 b is displayed after thecompletion of the maintenance work for adding the node indicated by theIP address “8.8.8.8”, so that the administrator may easily confirm thatthis node has been added and the information of the added node. Theadministrator may also confirm whether the added node operates asintended by confirming the content of the information.

FIG. 23 is a diagram illustrating a third display example of a grouptable and an asset table.

In a group table 171 c illustrated in FIG. 23, information of a groupidentified by a process name “ftp.exe”, an execution interval “1 day”, arepresentative address “1.1.1.1”, and a date “20191212” is displayed. Inthe case of FIG. 23, the node indicated by the IP address “7.7.7.7” isdeleted from the group including the nodes indicated by the IP addresses“1.1.1.1”, “5.5.5.5”, “6.6.6.6”, and “7.7.7.7”. However, in step S61,one of the nodes indicated by the IP addresses “1.1.1.1”, “5.5.5.5”, and“6.6.6.6” is designated.

In this case, in the process of FIG. 19, the group including the nodesindicated by IP addresses “1.1.1.1”, “5.5.5.5”, “6.6.6.6”, and “7.7.7.7”is specified as the main group (2). A group including nodes indicated byIP addresses “1.1.1.1”, “5.5.5.5”, and “6.6.6.6” is specified as themain group (1).

In step S69, the information of the record that is the record in themain group (2) but is not included in the main group (1) (record thatincludes the communication source address “1.1.1.1” and thecommunication destination address “7.7.7.7”) is displayed in the grouptable 171 c as difference information. As illustrated in FIG. 23, in thegroup table 171 c, information of the record is displayed in a recordR22. The record R22 is displayed surrounded by a thick broken line toindicate that it is difference information (deleted record). In the itemof the difference of the record R22, character information indicatingthat the record R22 has been deleted (the communication processindicated by the record R22 has been deleted) is displayed.

In step S70, information about each node included in such a group table171 c is read from the management target device list 141 of the devicelist storage unit 140 and displayed in an asset table 172 c. Forexample, in the asset table 172 c, not only the information of the nodesincluded in the current group but also the information of the nodesincluded in the previous corresponding group is displayed.

In the example of FIG. 23, the group table 171 c is displayed after thecompletion of the maintenance work for deleting (discarding) the nodeindicated by the IP address “7.7.7.7”, so the administrator may easilyconfirm that this node has been deleted and the information of thedeleted node. The administrator may also confirm whether each nodeincluded in the group after node deletion operates as intended byconfirming the content of the information.

The description will be continued below with reference to FIG. 20.

[Step S81] The management table output unit 133 determines whether aprogram corresponding to the processing process of the main group (1)has been newly installed in the node designated in step S61 of FIG. 19.The case where the program has been newly installed is a case where thenode designated in step S61 has already been incorporated in the system,but a new program has been installed in this node by maintenance work.In this case, a group unrelated to the main group (2) is specified asthe main group (1), and it is determined to be “No” in step S68.

In step S81, the previous main group for any other node included in themain group (1) is specified from the group data table (2). Hereinafter,the specified main group is referred to as a “main group (3)”. When thenode designated in step S61 is included in the main group (3), it isdetermined that a program corresponding to the processing process of themain group (1) has been newly installed in this node.

When it is determined that the program has been newly installed, themanagement table output unit 133 advances the process to step S82, andwhen it is determined that the program has not been newly installed, themanagement table output unit 133 advances the process to step S85.

[Step S82] The management table output unit 133 creates a group tableindicating information of the main group (1). In this group table, arecord in which the node designated in step S61 is registered isdisplayed as difference information. For example, as with the record R21of FIG. 22, the record in which the node designated in step S61 isregistered is surrounded by a thick line, and information indicatingthat the record is added is displayed in the item of the difference.

[Step S83] The management table output unit 133 creates an asset tablethat displays a list of information about each node included in thecreated group table.

[Step S84] The management table output unit 133 displays the group tablecreated in step S82 together with the asset table created in step S83 onthe display device of the administrator terminal 102.

[Step S85] The case determined as “No” in step S81 is a case where thenode designated in step S61 has been deleted from the main group (2).For example, there is a case where the program corresponding to thecommunication process of the main group (2) has been uninstalled fromthe node designated in step S61.

In this case, the management table output unit 133 first creates a grouptable indicating information of the main group (2). In this group table,a record in which the node designated in step S61 is registered isdisplayed as difference information.

[Step S86] Subsequently, the management table output unit 133 creates agroup table indicating information of the main group (1). In this grouptable, difference information is not displayed.

[Step S87] The management table output unit 133 creates an asset tablethat displays a list of the information about each node included in thegroup table created in step S85 and the information about each nodeincluded in the group table created in step S86.

[Step S88] The management table output unit 133 displays the grouptables created in steps S85 and S86 together with the asset tablecreated in step S87 on the display device of the administrator terminal102.

FIG. 24 is a diagram illustrating a fourth display example of grouptables and an asset table. FIG. 24 illustrates a display example whensteps S85 to S88 of FIG. 20 are executed. In FIG. 24, a group table 171d 1 is an example of the group table created in step S85, a group table171 d 2 is an example of the group table created in step S86, and anasset able 172 d is an example of the asset table created in step S87.

In the example of FIG. 24, the node indicated by the IP address“7.7.7.7” is designated in step S61 of FIG. 19. As the main group (2), agroup identified by a process name “ftp.exe”, an execution interval “1day”, a representative address “1.1.1.1” and a date “20191211” isspecified. The program corresponding to the communication process of themain group (2) has been uninstalled from the node indicated by the IPaddress “7.7.7.7” by the maintenance work. As a result, after themaintenance work, the group identified by the process name “sftp.exe”,the execution interval “1 day”, the representative address “1.1.1.1”,and the date “20191212” is specified as the main group (1) for the nodeindicated by the IP address “7.7.7.7”.

Information about the main group (1) is displayed in the group table 171d 2. On the other hand, in the group table 171 d 1, information aboutthe main group (2) is displayed together with the differenceinformation. In the group table 171 d 1, a record R23 including the IPaddress “7.7.7.7” is displayed surrounded by a thick broken line toindicate that the record is difference information (deleted record). Inthe item of the difference of the record R23, character informationindicating that the record R23 has been deleted (the communicationprocess indicated by the record R23 has been deleted) is displayed.

In the asset table 172 d, information about each node included in thegroup tables 171 d 1 and 171 d 2 is read from the management targetdevice list 141 of the device list storage unit 140 and displayed.

In the example of FIG. 24, the group table 171 d 1 is displayed afterthe completion of the uninstallation work in the node indicated by theIP address “7.7.7.7”, so that the administrator may easily confirm thatthe process corresponding to the uninstalled program does not operate inthis node. For example, the administrator may easily and reliablyconfirm that the system operates as intended after the maintenance work.

According to the process by the node management apparatus 101 describedabove, when performing maintenance work on a certain node, theadministrator may easily and reliably specify other nodes that may begreatly affected by the work by viewing the group table. When anabnormality occurs in a certain node, by viewing the group table for thegroup including the node, the administrator may specify another node forwhich the presence or absence of an abnormality is to be confirmed.

Since the difference information is displayed in the group table, theadministrator may easily and reliably confirm a node that has been addedor removed due to maintenance work and a node in which the process typeto be executed has been changed. The administrator may obtain usefulinformation for determining whether the system performs the intendedoperation after the maintenance work by viewing the group tableincluding the difference information. The administrator may obtainuseful information for investigating the cause of the failure after themaintenance work by viewing the group table including the differenceinformation. By viewing the group table including the differenceinformation, the administrator may be aware of the occurrence of anabnormality that may not be judged by appearance.

The process of FIGS. 19 and 20 may be modified as follows. For example,in step S63, the management table output unit 133 may specify a groupsimilar to the main group (1) from the previous group instead ofspecifying the previous main group. For example, in the previous group,a group in which the process name, the execution interval, and therepresentative address are the same as those of the main group (1) andthe number of duplicate nodes between the groups is the largest isspecified as a group similar to the main group (1).

In FIGS. 19 and 20, the designation of a node is accepted, and theinformation related to the node is displayed, but for example, each ofthe current groups may be displayed while being switched to theadministrator terminal 102. In this case, for example, the process ofstep S62 and subsequent steps is executed for each current group, instep S62, a group selected from the current groups is specified, and instep S63, a previous group similar to the group specified in step S62 isspecified. By executing the process of step S62 and subsequent steps foreach current group, a display screen including a group table and anasset table is created for each group, and any display screen isdisplayed on the administrator terminal 102 by the operation of theadministrator.

As illustrated in FIG. 25 below, when the number of differences may becounted for each group and may reach a predetermined value of one ormore, it may be determined that a difference has occurred in the groupconfiguration, and the difference information may be displayed in thegroup table.

FIG. 25 is a diagram illustrating an example of a difference occurrencedetermination process using the number of differences. In the group datatable 161, the number of differences is further registered for eachgroup. The number of differences indicates how many times the dataanalysis process by the data analysis unit 132 has been executed sincethe content of the group has changed. When the number of differencesreaches a predetermined determination threshold of one or more, it isdetermined that a difference has occurred in the group, and differenceinformation is displayed in the group table. As an example, thedetermination threshold is set to 2.

A table 181 in FIG. 25 illustrates information of a certain group at thetiming when the data analysis process is executed. This group isidentified by a process name “ftp.exe”, an execution interval “1 day”,and a representative address “1.1.1.1”. According to the table 181, thegroup includes nodes indicated by IP addresses “1.1.1.1”, “5.5.5.5”,“6.6.6.6”, and “7.7.7.7”. The number of differences is “0”.

Next, a table 182 illustrates information of the certain group at atiming when the data analysis process is executed next. Since thecontent of the table 182 is the same as that of the table 181, the groupindicated by the table 182 is the same as the group indicated by thetable 181, and there is no change in the configuration of the group.Therefore, in this case, the number of differences in the table 182remains “0”.

Next, a table 183 illustrates information of the certain group at atiming when the data analysis process is executed after the next.However, the information of this group is displayed in an areasurrounded by a solid line. This group is identified by a process name“ftp.exe”, an execution interval “1 day”, and a representative address“1.1.1.1”, which is the same as the group indicated by the table 182.However, in the group indicated in the table 183, there is no recordabout the communication process between the node indicated by the IPaddress “7.7.7.7” and the node indicated by the IP address “1.1.1.1”.Communication by a different process name “sftp.exe” is performedbetween these nodes. In this case, the number of differences of thegroup indicated in the table 183 is counted up to “1”.

Next, a table 184 illustrates information of the certain group at atiming when the data analysis process is executed one more after thenext. However, the information of this group is displayed in an areasurrounded by a solid line. This group is identified by a process name“ftp.exe”, an execution interval “1 day”, and a representative address“1.1.1.1”. Although the content of the table 184 is the same as that ofthe previous table 183, since the number of differences is “2”, thecontent of the table 184 is compared with the content of the table 182of the second previous time. Since there is a difference between thesepieces of content, the number of differences of the group illustrated inthe table 184 is counted up to “2”.

In the example of FIG. 25, even when the data analysis process wasperformed two times after the difference occurred in the configurationof the group (after the communication process of the node of the IPaddress “7.7.7.7” was deleted), the configuration of the group remainedchanged and did not return to the original state. In this case, themanagement table output unit 133 determines that a difference hasoccurred in the group configuration, and displays the differenceinformation about the node indicated by the IP address “7.7.7.7” in thegroup table indicating the information of the group indicated in thetable 184. With such a process, it is possible to reliably detect that adifference has occurred in a group configuration and present informationof the difference to the administrator.

Next, examples of maintenance work in a data center will be describedwith reference to FIGS. 26 to 28. In FIGS. 26 to 28, it is assumed thatthe nodes N1 to N6 are to be managed before maintenance work isperformed.

FIG. 26 is a diagram illustrating a first example of maintenance work.In the example of FIG. 26, before the maintenance work is performed, thenode N3 operates as a database server, and the node N1 operates as aclient thereof. In this state, it is assumed that the maintenance workof installing a program for the database server in the node N4 isperformed in order for the node N4 to operate as a database server inaddition to the node N3.

Before the maintenance work is performed, as illustrated in the upperpart of FIG. 26, the nodes N1 and N3 are included in the same group(referred to as an “SQL group”). Since the information of the SQL groupis displayed by the process of the node management apparatus 101, theadministrator may specify the nodes N1 and N3 as the nodes whoseoperation is to be stopped.

On the other hand, after the maintenance work is performed, asillustrated in the lower part of FIG. 26, the node N4 is included in theSQL group in addition to the nodes N1 and N3. When the grouping processis re-executed by the node management apparatus 101, the information ofthe SQL group including the nodes N1, N3, and N4 is displayed in thegroup table displayed by the process of the node management apparatus101, and the information of the communication process in the node N4 isdisplayed as difference information. By viewing such a group table, theadministrator may confirm that the node N4 operates correctly asintended.

FIG. 27 is a diagram illustrating a second example of maintenance work.In the example of FIG. 27, before the maintenance work is performed, thenodes N3 and N4 operate as Web servers, and the node N1 operates as aclient thereof. In this state, it is assumed that maintenance work isperformed to replace the Web server by replacing the node N4 with a nodeN7.

Before the maintenance work is performed, as illustrated in the upperpart of FIG. 27, the nodes N1, N3, and N4 are included in the same group(“HyperText Transfer Protocol (HTTP) group”). Since the information ofthe HTTP group is displayed by the process of the node managementapparatus 101, the administrator may specify the nodes N1, N3, and N4 asthe nodes whose operation is to be stopped.

On the other hand, when the maintenance work is correctly performed, thenodes N1, N3, and N7 are included in the HTTP group. However, in theexample of FIG. 27, it is assumed that a wrong program is installed inthe node N7 and correct communication is not resumed between the node N7and the node N1 which is the client. In this case, when the groupingprocess is re-executed by the node management apparatus 101, asillustrated in the lower part of FIG. 27, the information of the HTTPgroup including the nodes N1 and N3 is displayed in the group tabledisplayed by the process of the node management apparatus 101, and theinformation of the communication process in the node N4 before thereplacement is displayed as difference information. By viewing such agroup table, the administrator may recognize that the node N4 has notbeen replaced correctly.

FIG. 28 is a diagram illustrating a third example of maintenance work.In the example of FIG. 28, before the maintenance work is performed, thenodes N3 and N4 operate as file servers, and the node N1 operates as aclient thereof. In this state, it is assumed that maintenance work ofuncoupling the node N4 and discarding one file server is performed.

Before the maintenance work is performed, the nodes N1, N3, and N4 areincluded in the same group (referred to as an “FTP group”) asillustrated in the upper part of FIG. 28. Since the information of theFTP group is displayed by the process of the node management apparatus101, the administrator may specify the nodes N1, N3, and N4 as the nodeswhose operation is to be stopped.

On the other hand, after the maintenance work is performed, only thenodes N1 and N3 are included in the FTP group as illustrated in thelower part of FIG. 26. When the grouping process is re-executed by thenode management apparatus 101, the information of the FTP groupincluding the nodes N1 and N3 is displayed in the group table displayedby the process of the node management apparatus 101, and the informationof the communication process in the node N4 is displayed as differenceinformation. By viewing such a group table, the administrator mayconfirm that the node N4 is correctly discarded and the system operatescorrectly as intended.

The processing functions of the devices (for example, the managementapparatus 1, the node management apparatus 101, and the nodes N1, N2,N3, N4, . . . ) described in each of the embodiments may be implementedby computers. In such a case, there is provided a program describingprocessing content of functions to be included in each apparatus, andthe computer executes the program to implement the processing functionsin the computer. The program describing the processing content may berecorded in a computer-readable recording medium. The computer-readablerecording medium may be a magnetic storage device, an optical disc, asemiconductor memory, or the like. The magnetic storage device may be ahard disk drive (HDD), a magnetic tape, or the like. The optical discmay be a compact disc (CD), a digital versatile disc (DVD), a Blu-raydisc (BD, registered trademark), or the like.

In order to distribute the program, for example, portable recordingmedium, such as DVDs and CDs, on which the program is recorded are sold.The program may also be stored in a storage device of a server computerand be transferred from the server computer to other computers via anetwork.

The computer that executes the program, for example, stores the programrecorded on the portable recording medium or the program transferredfrom the server computer in its own storage device. The computer readsthe program from its own storage device and performs a process accordingto the program. The computer may also directly read the program from theportable recording medium and perform a process according to theprogram. The computer may also sequentially perform processes accordingto the received program each time the program is transferred from theserver computer coupled to the computer via the network.

All examples and conditional language provided herein are intended forthe pedagogical purposes of aiding the reader in understanding theinvention and the concepts contributed by the inventor to further theart, and are not to be construed as limitations to such specificallyrecited examples and conditions, nor does the organization of suchexamples in the specification relate to a showing of the superiority andinferiority of the invention. Although one or more embodiments of thepresent invention have been described in detail, it should be understoodthat the various changes, substitutions, and alterations could be madehereto without departing from the spirit and scope of the invention.

What is claimed is:
 1. A management apparatus comprising: a memory; anda processor coupled to the memory and configured to: execute a groupingprocess that includes a collection process configured to collectinformation from each of a plurality of devices based on a history ofcommunication processes executed with another device of the plurality ofdevices and store the information in the memory; execute a specificationprocess configured to specify one or more pairs of a communicationsource device and a communication destination device in whichcommunication processes of a same type were executed at a same timeinterval based on a process classification type indicating a type of acommunication process between the communication source device and thecommunication destination device and a time interval in which thecommunication process is performed, which are included in theinformation collected in the collection process; execute a creationprocess configured to create a group including the one or more pairs;and output display information for displaying information of the devicesincluded in the group created by the grouping process, the processorexecutes the grouping process a plurality of times with the timeinterval, in the output of the display information, when the groupingprocess is executed at a first timing, compares a first group created bythe grouping process with a second group created by the grouping processexecuted at a second timing before the first timing, and outputs, as thedisplay information, the display information that indicates informationof devices included in the first group and difference information fordisplaying a difference between the first group and the second group, asthe first group, of the groups created by the grouping process executedat the first timing, a group that includes a first device of theplurality of devices and includes most devices is selected, and as thesecond group to be compared with the first group, of the groups createdby the grouping process executed at the second timing, a group thatincludes the first device and includes the most devices is selected. 2.The management apparatus according to claim 1, wherein the differenceinformation is information that indicates a device included only in oneof the first group and the second group.
 3. The management apparatusaccording to claim 1, wherein as the second group to be compared withthe first group, of the groups created by the grouping process executedat the second timing, a group that has a same communication type andexecution time interval as the first group, and includes a duplicatedevice included in the first group is selected.
 4. The managementapparatus according to claim 1, wherein in each of the plurality ofdevices, based on the history, communication process information thatindicates communication processes of a same type executed at a same timeinterval with a same communication partner is created, and in thecollection process, as information based on the history, thecommunication process information is collected from each of theplurality of devices.
 5. The management apparatus according to claim 1,wherein in the grouping process, a pair of devices that have a sameprocess name to be executed and a time interval at which communicationprocesses are executed are grouped into the same group.
 6. Themanagement apparatus according to claim 1, wherein the displayinformation includes information that indicates content of acommunication process executed between the devices included in thegroup.
 7. A management system comprising a plurality of devices and amanagement apparatus, each of the plurality of devices accumulates ahistory of communication processes executed with another device of theplurality of devices in a memory, and based on the accumulated history,creates communication process information that indicates communicationprocesses of a same type executed at a same time interval with a samecommunication partner, and the management apparatus executes a groupingprocess that includes a collection process configured to collect thecommunication process information from each of the plurality of devices,a specification process configured to specify one or more pairs of acommunication source device and a communication destination device inwhich communication processes of a same type were executed at a sametime interval based on a process classification type indicating a typeof a communication process between the communication source device andthe communication destination device and a time interval in which thecommunication process is performed, which are included in the collectedcommunication process information a creation process configured tocreate a group including the one or more pairs, and outputs displayinformation for displaying information of the devices included in thegroup created by the grouping process, the management apparatus executesthe grouping process a plurality of times with the time interval, in theoutput of the display information, when the grouping process is executedat a first timing, compares a first group created by the groupingprocess with a second group created by the grouping process executed ata second timing before the first timing, and outputs, as the displayinformation, the display information that indicates information ofdevices included in the first group and difference information fordisplaying a difference between the first group and the second group, asthe first group, of the groups created by the grouping process executedat the first timing, a group that includes a first device of theplurality of devices and includes most devices is selected, and as thesecond group to be compared with the first group, of the groups createdby the grouping process executed at the second timing, a group thatincludes the first device and includes the most devices is selected. 8.A management method causing a computer to execute a process, the processcomprising: executing a grouping process that includes a collectionprocess configured to collect information from each of a plurality ofdevices based on a history of communication processes executed withanother device of the plurality of devices, and store the information ina memory, a specification process configured to specify one or morepairs of a communication source device and a communication destinationdevice in which communication processes of a same type were executed ata same time interval based on a process classification type indicating atype of a communication process between the communication source deviceand the communication destination device and a time interval in whichthe communication process is performed, which are included in theinformation collected in the collection process and a creation processconfigured to create a group including the one or more pairs; andoutputting display information for displaying information of the devicesincluded in the group created by the grouping process, the groupingprocess is executed a plurality of times with the time interval, in theoutput of the display information, when the grouping process is executedat a first timing, a first group created by the grouping process iscompared with a second group created by the grouping process executed ata second timing before the first timing, and as the display information,the display information that indicates information of devices includedin the first group and difference information for displaying adifference between the first group and the second group are output, asthe first group, of the groups created by the grouping process executedat the first timing, a group that includes a first device of theplurality of devices and includes most devices is selected, and as thesecond group to be compared with the first group, of the groups createdby the grouping process executed at the second timing, a group thatincludes the first device and includes the most devices is selected.